Privacy Policy

Introduction

This Privacy Policy describes how Filmustage Placement collects, uses, and shares information when you register as a brand or interact with the marketplace.

Data we collect

When you create a brand account or use the marketplace, we collect:

• Account email address (managed by our authentication provider) and an optional separate work_email on the brand profile.
• Brand profile fields: company name, website, logo, product categories, target markets, target audience demographics, and budget range.
• Express-interest events: which opportunities you marked, the project, scenes selected, and any free-text notes you provided.
• Recommendations sent to you by our team, including match scoring data and any personal note from the admin.
• Analytics events (page views, clicks, recommendation views, export and deletion requests) - only after you have accepted the cookie consent banner.
• Branded mockup images generated for opportunities you expressed interest in. These images are automatically deleted from storage 7 days after creation.

How we use your data

We use the data above to deliver the Placement service: matching brands with placement opportunities, sending transactional emails, generating AI-assisted recommendations and branded mockups, and producing aggregate-anonymous product analytics (only after consent).

Third-party processors

We share data with the following processors strictly to deliver the service:

• Supabase - Postgres database, authentication, and storage hosting.
• Resend - transactional email delivery (welcome, recommendation, GDPR confirmation messages).
• PostHog - product analytics. Only initialized and only sends events after you accept the cookie consent banner.
• Gemini (Google AI) - text-based recommendation matching against your brand profile.
• Imagen (Google AI) - branded mockup image generation.
• Sentry - error and exception reporting from the application backend.
• Telegram - admin alerting only. No brand-identifying data is sent to Telegram from Filmustage Placement.

Data retention

• Brand profile rows are retained for the lifetime of your account. On a deletion request (see “Your rights” below), the row is anonymized in place: PII columns are cleared and the row is marked with a deleted_at timestamp.
• Branded mockup image objects are deleted from storage 7 days after creation.
• Analytics events are retained for up to 24 months and then aggregated into anonymous summaries.
• Authentication records are hard-deleted from our auth provider when you submit a GDPR deletion request.

Your rights

If you are in the EU/EEA or otherwise covered by GDPR or an equivalent law, you have the following rights with respect to your data:

• Right of access - download a JSON dump of your brand row, interests, recommendations, and analytics events. Download your data. You must be signed in (otherwise the link returns 401).
• Right of erasure - request account deletion via DELETE /api/users/me. We anonymize your brand row in place (so filmmakers retain audit trail without your identifying details), hard-delete your authentication record, and email a confirmation. References from filmmakers (interests, recommendations) are kept without your identifying details.
• Right of rectification - update your brand profile from your dashboard, or contact us at the email below.
• Right to withdraw consent - clear the placement-consent cookie in your browser settings to re-prompt the consent banner; selecting Reject stops all analytics beacons.
• Right to object, restrict processing, or port - contact us using the address below; we will respond within 30 days.

Cookies and analytics consent

PostHog product analytics is initialized only after you accept the cookie consent banner. The banner persists your choice in a placement-consent cookie that expires after 365 days. If you reject, no PostHog beacons are sent. To re-prompt, clear the placement-consent cookie in your browser settings.

Contact

For privacy questions, data requests, or to exercise any right above, contact us at [email protected]. Filmustage does not currently have a separate Data Protection Officer; the contact above handles privacy matters for Filmustage Placement.

Changes to this policy

We will notify registered brands by email and post an in-app banner for material changes to this policy. Minor clarifications may be published with only the “Last updated” date refreshed.

Governing law

This policy is governed by the laws of Delaware, United States.